LXR linux/drivers/char/tpm/tpm2-cmd.c

   1/*
   2 * Copyright (C) 2014, 2015 Intel Corporation
   3 *
   4 * Authors:
   5 * Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
   6 *
   7 * Maintained by: <tpmdd-devel@lists.sourceforge.net>
   8 *
   9 * This file contains TPM2 protocol implementations of the commands
  10 * used by the kernel internally.
  11 *
  12 * This program is free software; you can redistribute it and/or
  13 * modify it under the terms of the GNU General Public License
  14 * as published by the Free Software Foundation; version 2
  15 * of the License.
  16 */
  17
  18#include "tpm.h"
  19#include <crypto/hash_info.h>
  20#include <keys/trusted-type.h>
  21
  22enum tpm2_object_attributes {
  23        TPM2_OA_USER_WITH_AUTH          = BIT(6),
  24};
  25
  26enum tpm2_session_attributes {
  27        TPM2_SA_CONTINUE_SESSION        = BIT(0),
  28};
  29
  30struct tpm2_startup_in {
  31        __be16  startup_type;
  32} __packed;
  33
  34struct tpm2_get_tpm_pt_in {
  35        __be32  cap_id;
  36        __be32  property_id;
  37        __be32  property_cnt;
  38} __packed;
  39
  40struct tpm2_get_tpm_pt_out {
  41        u8      more_data;
  42        __be32  subcap_id;
  43        __be32  property_cnt;
  44        __be32  property_id;
  45        __be32  value;
  46} __packed;
  47
  48struct tpm2_get_random_in {
  49        __be16  size;
  50} __packed;
  51
  52struct tpm2_get_random_out {
  53        __be16  size;
  54        u8      buffer[TPM_MAX_RNG_DATA];
  55} __packed;
  56
  57union tpm2_cmd_params {
  58        struct  tpm2_startup_in         startup_in;
  59        struct  tpm2_get_tpm_pt_in      get_tpm_pt_in;
  60        struct  tpm2_get_tpm_pt_out     get_tpm_pt_out;
  61        struct  tpm2_get_random_in      getrandom_in;
  62        struct  tpm2_get_random_out     getrandom_out;
  63};
  64
  65struct tpm2_cmd {
  66        tpm_cmd_header          header;
  67        union tpm2_cmd_params   params;
  68} __packed;
  69
  70struct tpm2_hash {
  71        unsigned int crypto_id;
  72        unsigned int tpm_id;
  73};
  74
  75static struct tpm2_hash tpm2_hash_map[] = {
  76        {HASH_ALGO_SHA1, TPM2_ALG_SHA1},
  77        {HASH_ALGO_SHA256, TPM2_ALG_SHA256},
  78        {HASH_ALGO_SHA384, TPM2_ALG_SHA384},
  79        {HASH_ALGO_SHA512, TPM2_ALG_SHA512},
  80        {HASH_ALGO_SM3_256, TPM2_ALG_SM3_256},
  81};
  82
  83/*
  84 * Array with one entry per ordinal defining the maximum amount
  85 * of time the chip could take to return the result. The values
  86 * of the SHORT, MEDIUM, and LONG durations are taken from the
  87 * PC Client Profile (PTP) specification.
  88 * LONG_LONG is for commands that generates keys which empirically
  89 * takes longer time on some systems.
  90 */
  91static const u8 tpm2_ordinal_duration[TPM2_CC_LAST - TPM2_CC_FIRST + 1] = {
  92        TPM_UNDEFINED,          /* 11F */
  93        TPM_UNDEFINED,          /* 120 */
  94        TPM_LONG,               /* 121 */
  95        TPM_UNDEFINED,          /* 122 */
  96        TPM_UNDEFINED,          /* 123 */
  97        TPM_UNDEFINED,          /* 124 */
  98        TPM_UNDEFINED,          /* 125 */
  99        TPM_UNDEFINED,          /* 126 */
 100        TPM_UNDEFINED,          /* 127 */
 101        TPM_UNDEFINED,          /* 128 */
 102        TPM_LONG,               /* 129 */
 103        TPM_UNDEFINED,          /* 12a */
 104        TPM_UNDEFINED,          /* 12b */
 105        TPM_UNDEFINED,          /* 12c */
 106        TPM_UNDEFINED,          /* 12d */
 107        TPM_UNDEFINED,          /* 12e */
 108        TPM_UNDEFINED,          /* 12f */
 109        TPM_UNDEFINED,          /* 130 */
 110        TPM_LONG_LONG,          /* 131 */
 111        TPM_UNDEFINED,          /* 132 */
 112        TPM_UNDEFINED,          /* 133 */
 113        TPM_UNDEFINED,          /* 134 */
 114        TPM_UNDEFINED,          /* 135 */
 115        TPM_UNDEFINED,          /* 136 */
 116        TPM_UNDEFINED,          /* 137 */
 117        TPM_UNDEFINED,          /* 138 */
 118        TPM_UNDEFINED,          /* 139 */
 119        TPM_UNDEFINED,          /* 13a */
 120        TPM_UNDEFINED,          /* 13b */
 121        TPM_UNDEFINED,          /* 13c */
 122        TPM_UNDEFINED,          /* 13d */
 123        TPM_MEDIUM,             /* 13e */
 124        TPM_UNDEFINED,          /* 13f */
 125        TPM_UNDEFINED,          /* 140 */
 126        TPM_UNDEFINED,          /* 141 */
 127        TPM_UNDEFINED,          /* 142 */
 128        TPM_LONG,               /* 143 */
 129        TPM_MEDIUM,             /* 144 */
 130        TPM_UNDEFINED,          /* 145 */
 131        TPM_UNDEFINED,          /* 146 */
 132        TPM_UNDEFINED,          /* 147 */
 133        TPM_UNDEFINED,          /* 148 */
 134        TPM_UNDEFINED,          /* 149 */
 135        TPM_UNDEFINED,          /* 14a */
 136        TPM_UNDEFINED,          /* 14b */
 137        TPM_UNDEFINED,          /* 14c */
 138        TPM_UNDEFINED,          /* 14d */
 139        TPM_LONG,               /* 14e */
 140        TPM_UNDEFINED,          /* 14f */
 141        TPM_UNDEFINED,          /* 150 */
 142        TPM_UNDEFINED,          /* 151 */
 143        TPM_UNDEFINED,          /* 152 */
 144        TPM_LONG_LONG,          /* 153 */
 145        TPM_UNDEFINED,          /* 154 */
 146        TPM_UNDEFINED,          /* 155 */
 147        TPM_UNDEFINED,          /* 156 */
 148        TPM_UNDEFINED,          /* 157 */
 149        TPM_UNDEFINED,          /* 158 */
 150        TPM_UNDEFINED,          /* 159 */
 151        TPM_UNDEFINED,          /* 15a */
 152        TPM_UNDEFINED,          /* 15b */
 153        TPM_MEDIUM,             /* 15c */
 154        TPM_UNDEFINED,          /* 15d */
 155        TPM_UNDEFINED,          /* 15e */
 156        TPM_UNDEFINED,          /* 15f */
 157        TPM_UNDEFINED,          /* 160 */
 158        TPM_UNDEFINED,          /* 161 */
 159        TPM_UNDEFINED,          /* 162 */
 160        TPM_UNDEFINED,          /* 163 */
 161        TPM_UNDEFINED,          /* 164 */
 162        TPM_UNDEFINED,          /* 165 */
 163        TPM_UNDEFINED,          /* 166 */
 164        TPM_UNDEFINED,          /* 167 */
 165        TPM_UNDEFINED,          /* 168 */
 166        TPM_UNDEFINED,          /* 169 */
 167        TPM_UNDEFINED,          /* 16a */
 168        TPM_UNDEFINED,          /* 16b */
 169        TPM_UNDEFINED,          /* 16c */
 170        TPM_UNDEFINED,          /* 16d */
 171        TPM_UNDEFINED,          /* 16e */
 172        TPM_UNDEFINED,          /* 16f */
 173        TPM_UNDEFINED,          /* 170 */
 174        TPM_UNDEFINED,          /* 171 */
 175        TPM_UNDEFINED,          /* 172 */
 176        TPM_UNDEFINED,          /* 173 */
 177        TPM_UNDEFINED,          /* 174 */
 178        TPM_UNDEFINED,          /* 175 */
 179        TPM_UNDEFINED,          /* 176 */
 180        TPM_LONG,               /* 177 */
 181        TPM_UNDEFINED,          /* 178 */
 182        TPM_UNDEFINED,          /* 179 */
 183        TPM_MEDIUM,             /* 17a */
 184        TPM_LONG,               /* 17b */
 185        TPM_UNDEFINED,          /* 17c */
 186        TPM_UNDEFINED,          /* 17d */
 187        TPM_UNDEFINED,          /* 17e */
 188        TPM_UNDEFINED,          /* 17f */
 189        TPM_UNDEFINED,          /* 180 */
 190        TPM_UNDEFINED,          /* 181 */
 191        TPM_MEDIUM,             /* 182 */
 192        TPM_UNDEFINED,          /* 183 */
 193        TPM_UNDEFINED,          /* 184 */
 194        TPM_MEDIUM,             /* 185 */
 195        TPM_MEDIUM,             /* 186 */
 196        TPM_UNDEFINED,          /* 187 */
 197        TPM_UNDEFINED,          /* 188 */
 198        TPM_UNDEFINED,          /* 189 */
 199        TPM_UNDEFINED,          /* 18a */
 200        TPM_UNDEFINED,          /* 18b */
 201        TPM_UNDEFINED,          /* 18c */
 202        TPM_UNDEFINED,          /* 18d */
 203        TPM_UNDEFINED,          /* 18e */
 204        TPM_UNDEFINED           /* 18f */
 205};
 206
 207struct tpm2_pcr_read_out {
 208        __be32  update_cnt;
 209        __be32  pcr_selects_cnt;
 210        __be16  hash_alg;
 211        u8      pcr_select_size;
 212        u8      pcr_select[TPM2_PCR_SELECT_MIN];
 213        __be32  digests_cnt;
 214        __be16  digest_size;
 215        u8      digest[];
 216} __packed;
 217
 218/**
 219 * tpm2_pcr_read() - read a PCR value
 220 * @chip:       TPM chip to use.
 221 * @pcr_idx:    index of the PCR to read.
 222 * @res_buf:    buffer to store the resulting hash.
 223 *
 224 * Return: Same as with tpm_transmit_cmd.
 225 */
 226int tpm2_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
 227{
 228        int rc;
 229        struct tpm_buf buf;
 230        struct tpm2_pcr_read_out *out;
 231        u8 pcr_select[TPM2_PCR_SELECT_MIN] = {0};
 232
 233        if (pcr_idx >= TPM2_PLATFORM_PCR)
 234                return -EINVAL;
 235
 236        rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_PCR_READ);
 237        if (rc)
 238                return rc;
 239
 240        pcr_select[pcr_idx >> 3] = 1 << (pcr_idx & 0x7);
 241
 242        tpm_buf_append_u32(&buf, 1);
 243        tpm_buf_append_u16(&buf, TPM2_ALG_SHA1);
 244        tpm_buf_append_u8(&buf, TPM2_PCR_SELECT_MIN);
 245        tpm_buf_append(&buf, (const unsigned char *)pcr_select,
 246                       sizeof(pcr_select));
 247
 248        rc = tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE, 0, 0,
 249                        res_buf ? "attempting to read a pcr value" : NULL);
 250        if (rc == 0 && res_buf) {
 251                out = (struct tpm2_pcr_read_out *)&buf.data[TPM_HEADER_SIZE];
 252                memcpy(res_buf, out->digest, SHA1_DIGEST_SIZE);
 253        }
 254
 255        tpm_buf_destroy(&buf);
 256        return rc;
 257}
 258
 259struct tpm2_null_auth_area {
 260        __be32  handle;
 261        __be16  nonce_size;
 262        u8  attributes;
 263        __be16  auth_size;
 264} __packed;
 265
 266/**
 267 * tpm2_pcr_extend() - extend a PCR value
 268 *
 269 * @chip:       TPM chip to use.
 270 * @pcr_idx:    index of the PCR.
 271 * @count:      number of digests passed.
 272 * @digests:    list of pcr banks and corresponding digest values to extend.
 273 *
 274 * Return: Same as with tpm_transmit_cmd.
 275 */
 276int tpm2_pcr_extend(struct tpm_chip *chip, int pcr_idx, u32 count,
 277                    struct tpm2_digest *digests)
 278{
 279        struct tpm_buf buf;
 280        struct tpm2_null_auth_area auth_area;
 281        int rc;
 282        int i;
 283        int j;
 284
 285        if (count > ARRAY_SIZE(chip->active_banks))
 286                return -EINVAL;
 287
 288        rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_PCR_EXTEND);
 289        if (rc)
 290                return rc;
 291
 292        tpm_buf_append_u32(&buf, pcr_idx);
 293
 294        auth_area.handle = cpu_to_be32(TPM2_RS_PW);
 295        auth_area.nonce_size = 0;
 296        auth_area.attributes = 0;
 297        auth_area.auth_size = 0;
 298
 299        tpm_buf_append_u32(&buf, sizeof(struct tpm2_null_auth_area));
 300        tpm_buf_append(&buf, (const unsigned char *)&auth_area,
 301                       sizeof(auth_area));
 302        tpm_buf_append_u32(&buf, count);
 303
 304        for (i = 0; i < count; i++) {
 305                for (j = 0; j < ARRAY_SIZE(tpm2_hash_map); j++) {
 306                        if (digests[i].alg_id != tpm2_hash_map[j].tpm_id)
 307                                continue;
 308                        tpm_buf_append_u16(&buf, digests[i].alg_id);
 309                        tpm_buf_append(&buf, (const unsigned char
 310                                              *)&digests[i].digest,
 311                               hash_digest_size[tpm2_hash_map[j].crypto_id]);
 312                }
 313        }
 314
 315        rc = tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE, 0, 0,
 316                              "attempting extend a PCR value");
 317
 318        tpm_buf_destroy(&buf);
 319
 320        return rc;
 321}
 322
 323
 324#define TPM2_GETRANDOM_IN_SIZE \
 325        (sizeof(struct tpm_input_header) + \
 326         sizeof(struct tpm2_get_random_in))
 327
 328static const struct tpm_input_header tpm2_getrandom_header = {
 329        .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
 330        .length = cpu_to_be32(TPM2_GETRANDOM_IN_SIZE),
 331        .ordinal = cpu_to_be32(TPM2_CC_GET_RANDOM)
 332};
 333
 334/**
 335 * tpm2_get_random() - get random bytes from the TPM RNG
 336 *
 337 * @chip: TPM chip to use
 338 * @out: destination buffer for the random bytes
 339 * @max: the max number of bytes to write to @out
 340 *
 341 * Return:
 342 *    Size of the output buffer, or -EIO on error.
 343 */
 344int tpm2_get_random(struct tpm_chip *chip, u8 *out, size_t max)
 345{
 346        struct tpm2_cmd cmd;
 347        u32 recd, rlength;
 348        u32 num_bytes;
 349        int err;
 350        int total = 0;
 351        int retries = 5;
 352        u8 *dest = out;
 353
 354        num_bytes = min_t(u32, max, sizeof(cmd.params.getrandom_out.buffer));
 355
 356        if (!out || !num_bytes ||
 357            max > sizeof(cmd.params.getrandom_out.buffer))
 358                return -EINVAL;
 359
 360        do {
 361                cmd.header.in = tpm2_getrandom_header;
 362                cmd.params.getrandom_in.size = cpu_to_be16(num_bytes);
 363
 364                err = tpm_transmit_cmd(chip, NULL, &cmd, sizeof(cmd),
 365                                       offsetof(struct tpm2_get_random_out,
 366                                                buffer),
 367                                       0, "attempting get random");
 368                if (err)
 369                        break;
 370
 371                recd = min_t(u32, be16_to_cpu(cmd.params.getrandom_out.size),
 372                             num_bytes);
 373                rlength = be32_to_cpu(cmd.header.out.length);
 374                if (rlength < offsetof(struct tpm2_get_random_out, buffer) +
 375                              recd)
 376                        return -EFAULT;
 377                memcpy(dest, cmd.params.getrandom_out.buffer, recd);
 378
 379                dest += recd;
 380                total += recd;
 381                num_bytes -= recd;
 382        } while (retries-- && total < max);
 383
 384        return total ? total : -EIO;
 385}
 386
 387#define TPM2_GET_TPM_PT_IN_SIZE \
 388        (sizeof(struct tpm_input_header) + \
 389         sizeof(struct tpm2_get_tpm_pt_in))
 390
 391#define TPM2_GET_TPM_PT_OUT_BODY_SIZE \
 392         sizeof(struct tpm2_get_tpm_pt_out)
 393
 394static const struct tpm_input_header tpm2_get_tpm_pt_header = {
 395        .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
 396        .length = cpu_to_be32(TPM2_GET_TPM_PT_IN_SIZE),
 397        .ordinal = cpu_to_be32(TPM2_CC_GET_CAPABILITY)
 398};
 399
 400/**
 401 * tpm2_flush_context_cmd() - execute a TPM2_FlushContext command
 402 * @chip: TPM chip to use
 403 * @payload: the key data in clear and encrypted form
 404 * @options: authentication values and other options
 405 *
 406 * Return: same as with tpm_transmit_cmd
 407 */
 408void tpm2_flush_context_cmd(struct tpm_chip *chip, u32 handle,
 409                            unsigned int flags)
 410{
 411        struct tpm_buf buf;
 412        int rc;
 413
 414        rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_FLUSH_CONTEXT);
 415        if (rc) {
 416                dev_warn(&chip->dev, "0x%08x was not flushed, out of memory\n",
 417                         handle);
 418                return;
 419        }
 420
 421        tpm_buf_append_u32(&buf, handle);
 422
 423        (void) tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE, 0, flags,
 424                                "flushing context");
 425
 426        tpm_buf_destroy(&buf);
 427}
 428
 429/**
 430 * tpm_buf_append_auth() - append TPMS_AUTH_COMMAND to the buffer.
 431 *
 432 * @buf: an allocated tpm_buf instance
 433 * @session_handle: session handle
 434 * @nonce: the session nonce, may be NULL if not used
 435 * @nonce_len: the session nonce length, may be 0 if not used
 436 * @attributes: the session attributes
 437 * @hmac: the session HMAC or password, may be NULL if not used
 438 * @hmac_len: the session HMAC or password length, maybe 0 if not used
 439 */
 440static void tpm2_buf_append_auth(struct tpm_buf *buf, u32 session_handle,
 441                                 const u8 *nonce, u16 nonce_len,
 442                                 u8 attributes,
 443                                 const u8 *hmac, u16 hmac_len)
 444{
 445        tpm_buf_append_u32(buf, 9 + nonce_len + hmac_len);
 446        tpm_buf_append_u32(buf, session_handle);
 447        tpm_buf_append_u16(buf, nonce_len);
 448
 449        if (nonce && nonce_len)
 450                tpm_buf_append(buf, nonce, nonce_len);
 451
 452        tpm_buf_append_u8(buf, attributes);
 453        tpm_buf_append_u16(buf, hmac_len);
 454
 455        if (hmac && hmac_len)
 456                tpm_buf_append(buf, hmac, hmac_len);
 457}
 458
 459/**
 460 * tpm2_seal_trusted() - seal the payload of a trusted key
 461 *
 462 * @chip: TPM chip to use
 463 * @payload: the key data in clear and encrypted form
 464 * @options: authentication values and other options
 465 *
 466 * Return: < 0 on error and 0 on success.
 467 */
 468int tpm2_seal_trusted(struct tpm_chip *chip,
 469                      struct trusted_key_payload *payload,
 470                      struct trusted_key_options *options)
 471{
 472        unsigned int blob_len;
 473        struct tpm_buf buf;
 474        u32 hash, rlength;
 475        int i;
 476        int rc;
 477
 478        for (i = 0; i < ARRAY_SIZE(tpm2_hash_map); i++) {
 479                if (options->hash == tpm2_hash_map[i].crypto_id) {
 480                        hash = tpm2_hash_map[i].tpm_id;
 481                        break;
 482                }
 483        }
 484
 485        if (i == ARRAY_SIZE(tpm2_hash_map))
 486                return -EINVAL;
 487
 488        rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_CREATE);
 489        if (rc)
 490                return rc;
 491
 492        tpm_buf_append_u32(&buf, options->keyhandle);
 493        tpm2_buf_append_auth(&buf, TPM2_RS_PW,
 494                             NULL /* nonce */, 0,
 495                             0 /* session_attributes */,
 496                             options->keyauth /* hmac */,
 497                             TPM_DIGEST_SIZE);
 498
 499        /* sensitive */
 500        tpm_buf_append_u16(&buf, 4 + TPM_DIGEST_SIZE + payload->key_len + 1);
 501
 502        tpm_buf_append_u16(&buf, TPM_DIGEST_SIZE);
 503        tpm_buf_append(&buf, options->blobauth, TPM_DIGEST_SIZE);
 504        tpm_buf_append_u16(&buf, payload->key_len + 1);
 505        tpm_buf_append(&buf, payload->key, payload->key_len);
 506        tpm_buf_append_u8(&buf, payload->migratable);
 507
 508        /* public */
 509        tpm_buf_append_u16(&buf, 14 + options->policydigest_len);
 510        tpm_buf_append_u16(&buf, TPM2_ALG_KEYEDHASH);
 511        tpm_buf_append_u16(&buf, hash);
 512
 513        /* policy */
 514        if (options->policydigest_len) {
 515                tpm_buf_append_u32(&buf, 0);
 516                tpm_buf_append_u16(&buf, options->policydigest_len);
 517                tpm_buf_append(&buf, options->policydigest,
 518                               options->policydigest_len);
 519        } else {
 520                tpm_buf_append_u32(&buf, TPM2_OA_USER_WITH_AUTH);
 521                tpm_buf_append_u16(&buf, 0);
 522        }
 523
 524        /* public parameters */
 525        tpm_buf_append_u16(&buf, TPM2_ALG_NULL);
 526        tpm_buf_append_u16(&buf, 0);
 527
 528        /* outside info */
 529        tpm_buf_append_u16(&buf, 0);
 530
 531        /* creation PCR */
 532        tpm_buf_append_u32(&buf, 0);
 533
 534        if (buf.flags & TPM_BUF_OVERFLOW) {
 535                rc = -E2BIG;
 536                goto out;
 537        }
 538
 539        rc = tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE, 4, 0,
 540                              "sealing data");
 541        if (rc)
 542                goto out;
 543
 544        blob_len = be32_to_cpup((__be32 *) &buf.data[TPM_HEADER_SIZE]);
 545        if (blob_len > MAX_BLOB_SIZE) {
 546                rc = -E2BIG;
 547                goto out;
 548        }
 549        rlength = be32_to_cpu(((struct tpm2_cmd *)&buf)->header.out.length);
 550        if (rlength < TPM_HEADER_SIZE + 4 + blob_len) {
 551                rc = -EFAULT;
 552                goto out;
 553        }
 554
 555        memcpy(payload->blob, &buf.data[TPM_HEADER_SIZE + 4], blob_len);
 556        payload->blob_len = blob_len;
 557
 558out:
 559        tpm_buf_destroy(&buf);
 560
 561        if (rc > 0) {
 562                if (tpm2_rc_value(rc) == TPM2_RC_HASH)
 563                        rc = -EINVAL;
 564                else
 565                        rc = -EPERM;
 566        }
 567
 568        return rc;
 569}
 570
 571/**
 572 * tpm2_load_cmd() - execute a TPM2_Load command
 573 *
 574 * @chip: TPM chip to use
 575 * @payload: the key data in clear and encrypted form
 576 * @options: authentication values and other options
 577 * @blob_handle: returned blob handle
 578 * @flags: tpm transmit flags
 579 *
 580 * Return: 0 on success.
 581 *        -E2BIG on wrong payload size.
 582 *        -EPERM on tpm error status.
 583 *        < 0 error from tpm_transmit_cmd.
 584 */
 585static int tpm2_load_cmd(struct tpm_chip *chip,
 586                         struct trusted_key_payload *payload,
 587                         struct trusted_key_options *options,
 588                         u32 *blob_handle, unsigned int flags)
 589{
 590        struct tpm_buf buf;
 591        unsigned int private_len;
 592        unsigned int public_len;
 593        unsigned int blob_len;
 594        int rc;
 595
 596        private_len = be16_to_cpup((__be16 *) &payload->blob[0]);
 597        if (private_len > (payload->blob_len - 2))
 598                return -E2BIG;
 599
 600        public_len = be16_to_cpup((__be16 *) &payload->blob[2 + private_len]);
 601        blob_len = private_len + public_len + 4;
 602        if (blob_len > payload->blob_len)
 603                return -E2BIG;
 604
 605        rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_LOAD);
 606        if (rc)
 607                return rc;
 608
 609        tpm_buf_append_u32(&buf, options->keyhandle);
 610        tpm2_buf_append_auth(&buf, TPM2_RS_PW,
 611                             NULL /* nonce */, 0,
 612                             0 /* session_attributes */,
 613                             options->keyauth /* hmac */,
 614                             TPM_DIGEST_SIZE);
 615
 616        tpm_buf_append(&buf, payload->blob, blob_len);
 617
 618        if (buf.flags & TPM_BUF_OVERFLOW) {
 619                rc = -E2BIG;
 620                goto out;
 621        }
 622
 623        rc = tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE, 4, flags,
 624                              "loading blob");
 625        if (!rc)
 626                *blob_handle = be32_to_cpup(
 627                        (__be32 *) &buf.data[TPM_HEADER_SIZE]);
 628
 629out:
 630        tpm_buf_destroy(&buf);
 631
 632        if (rc > 0)
 633                rc = -EPERM;
 634
 635        return rc;
 636}
 637
 638/**
 639 * tpm2_unseal_cmd() - execute a TPM2_Unload command
 640 *
 641 * @chip: TPM chip to use
 642 * @payload: the key data in clear and encrypted form
 643 * @options: authentication values and other options
 644 * @blob_handle: blob handle
 645 * @flags: tpm_transmit_cmd flags
 646 *
 647 * Return: 0 on success
 648 *         -EPERM on tpm error status
 649 *         < 0 error from tpm_transmit_cmd
 650 */
 651static int tpm2_unseal_cmd(struct tpm_chip *chip,
 652                           struct trusted_key_payload *payload,
 653                           struct trusted_key_options *options,
 654                           u32 blob_handle, unsigned int flags)
 655{
 656        struct tpm_buf buf;
 657        u16 data_len;
 658        u8 *data;
 659        int rc;
 660        u32 rlength;
 661
 662        rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_UNSEAL);
 663        if (rc)
 664                return rc;
 665
 666        tpm_buf_append_u32(&buf, blob_handle);
 667        tpm2_buf_append_auth(&buf,
 668                             options->policyhandle ?
 669                             options->policyhandle : TPM2_RS_PW,
 670                             NULL /* nonce */, 0,
 671                             TPM2_SA_CONTINUE_SESSION,
 672                             options->blobauth /* hmac */,
 673                             TPM_DIGEST_SIZE);
 674
 675        rc = tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE, 6, flags,
 676                              "unsealing");
 677        if (rc > 0)
 678                rc = -EPERM;
 679
 680        if (!rc) {
 681                data_len = be16_to_cpup(
 682                        (__be16 *) &buf.data[TPM_HEADER_SIZE + 4]);
 683                if (data_len < MIN_KEY_SIZE ||  data_len > MAX_KEY_SIZE + 1) {
 684                        rc = -EFAULT;
 685                        goto out;
 686                }
 687
 688                rlength = be32_to_cpu(((struct tpm2_cmd *)&buf)
 689                                        ->header.out.length);
 690                if (rlength < TPM_HEADER_SIZE + 6 + data_len) {
 691                        rc = -EFAULT;
 692                        goto out;
 693                }
 694                data = &buf.data[TPM_HEADER_SIZE + 6];
 695
 696                memcpy(payload->key, data, data_len - 1);
 697                payload->key_len = data_len - 1;
 698                payload->migratable = data[data_len - 1];
 699        }
 700
 701out:
 702        tpm_buf_destroy(&buf);
 703        return rc;
 704}
 705
 706/**
 707 * tpm2_unseal_trusted() - unseal the payload of a trusted key
 708 *
 709 * @chip: TPM chip to use
 710 * @payload: the key data in clear and encrypted form
 711 * @options: authentication values and other options
 712 *
 713 * Return: Same as with tpm_transmit_cmd.
 714 */
 715int tpm2_unseal_trusted(struct tpm_chip *chip,
 716                        struct trusted_key_payload *payload,
 717                        struct trusted_key_options *options)
 718{
 719        u32 blob_handle;
 720        int rc;
 721
 722        mutex_lock(&chip->tpm_mutex);
 723        rc = tpm2_load_cmd(chip, payload, options, &blob_handle,
 724                           TPM_TRANSMIT_UNLOCKED);
 725        if (rc)
 726                goto out;
 727
 728        rc = tpm2_unseal_cmd(chip, payload, options, blob_handle,
 729                             TPM_TRANSMIT_UNLOCKED);
 730        tpm2_flush_context_cmd(chip, blob_handle, TPM_TRANSMIT_UNLOCKED);
 731out:
 732        mutex_unlock(&chip->tpm_mutex);
 733        return rc;
 734}
 735
 736/**
 737 * tpm2_get_tpm_pt() - get value of a TPM_CAP_TPM_PROPERTIES type property
 738 * @chip:               TPM chip to use.
 739 * @property_id:        property ID.
 740 * @value:              output variable.
 741 * @desc:               passed to tpm_transmit_cmd()
 742 *
 743 * Return: Same as with tpm_transmit_cmd.
 744 */
 745ssize_t tpm2_get_tpm_pt(struct tpm_chip *chip, u32 property_id,  u32 *value,
 746                        const char *desc)
 747{
 748        struct tpm2_cmd cmd;
 749        int rc;
 750
 751        cmd.header.in = tpm2_get_tpm_pt_header;
 752        cmd.params.get_tpm_pt_in.cap_id = cpu_to_be32(TPM2_CAP_TPM_PROPERTIES);
 753        cmd.params.get_tpm_pt_in.property_id = cpu_to_be32(property_id);
 754        cmd.params.get_tpm_pt_in.property_cnt = cpu_to_be32(1);
 755
 756        rc = tpm_transmit_cmd(chip, NULL, &cmd, sizeof(cmd),
 757                              TPM2_GET_TPM_PT_OUT_BODY_SIZE, 0, desc);
 758        if (!rc)
 759                *value = be32_to_cpu(cmd.params.get_tpm_pt_out.value);
 760
 761        return rc;
 762}
 763EXPORT_SYMBOL_GPL(tpm2_get_tpm_pt);
 764
 765#define TPM2_SHUTDOWN_IN_SIZE \
 766        (sizeof(struct tpm_input_header) + \
 767         sizeof(struct tpm2_startup_in))
 768
 769static const struct tpm_input_header tpm2_shutdown_header = {
 770        .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
 771        .length = cpu_to_be32(TPM2_SHUTDOWN_IN_SIZE),
 772        .ordinal = cpu_to_be32(TPM2_CC_SHUTDOWN)
 773};
 774
 775/**
 776 * tpm2_shutdown() - send shutdown command to the TPM chip
 777 *
 778 * @chip:               TPM chip to use.
 779 * @shutdown_type:      shutdown type. The value is either
 780 *                      TPM_SU_CLEAR or TPM_SU_STATE.
 781 */
 782void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type)
 783{
 784        struct tpm2_cmd cmd;
 785        int rc;
 786
 787        cmd.header.in = tpm2_shutdown_header;
 788        cmd.params.startup_in.startup_type = cpu_to_be16(shutdown_type);
 789
 790        rc = tpm_transmit_cmd(chip, NULL, &cmd, sizeof(cmd), 0, 0,
 791                              "stopping the TPM");
 792
 793        /* In places where shutdown command is sent there's no much we can do
 794         * except print the error code on a system failure.
 795         */
 796        if (rc < 0 && rc != -EPIPE)
 797                dev_warn(&chip->dev, "transmit returned %d while stopping the TPM",
 798                         rc);
 799}
 800
 801/*
 802 * tpm2_calc_ordinal_duration() - maximum duration for a command
 803 *
 804 * @chip:       TPM chip to use.
 805 * @ordinal:    command code number.
 806 *
 807 * Return: maximum duration for a command
 808 */
 809unsigned long tpm2_calc_ordinal_duration(struct tpm_chip *chip, u32 ordinal)
 810{
 811        int index = TPM_UNDEFINED;
 812        int duration = 0;
 813
 814        if (ordinal >= TPM2_CC_FIRST && ordinal <= TPM2_CC_LAST)
 815                index = tpm2_ordinal_duration[ordinal - TPM2_CC_FIRST];
 816
 817        if (index != TPM_UNDEFINED)
 818                duration = chip->duration[index];
 819
 820        if (duration <= 0)
 821                duration = msecs_to_jiffies(TPM2_DURATION_DEFAULT);
 822
 823        return duration;
 824}
 825EXPORT_SYMBOL_GPL(tpm2_calc_ordinal_duration);
 826
 827/**
 828 * tpm2_do_selftest() - ensure that all self tests have passed
 829 *
 830 * @chip: TPM chip to use
 831 *
 832 * Return: Same as with tpm_transmit_cmd.
 833 *
 834 * The TPM can either run all self tests synchronously and then return
 835 * RC_SUCCESS once all tests were successful. Or it can choose to run the tests
 836 * asynchronously and return RC_TESTING immediately while the self tests still
 837 * execute in the background. This function handles both cases and waits until
 838 * all tests have completed.
 839 */
 840static int tpm2_do_selftest(struct tpm_chip *chip)
 841{
 842        struct tpm_buf buf;
 843        int full;
 844        int rc;
 845
 846        for (full = 0; full < 2; full++) {
 847                rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_SELF_TEST);
 848                if (rc)
 849                        return rc;
 850
 851                tpm_buf_append_u8(&buf, full);
 852                rc = tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE, 0, 0,
 853                                      "attempting the self test");
 854                tpm_buf_destroy(&buf);
 855
 856                if (rc == TPM2_RC_TESTING)
 857                        rc = TPM2_RC_SUCCESS;
 858                if (rc == TPM2_RC_INITIALIZE || rc == TPM2_RC_SUCCESS)
 859                        return rc;
 860        }
 861
 862        return rc;
 863}
 864
 865/**
 866 * tpm2_probe() - probe TPM 2.0
 867 * @chip: TPM chip to use
 868 *
 869 * Return: < 0 error and 0 on success.
 870 *
 871 * Send idempotent TPM 2.0 command and see whether TPM 2.0 chip replied based on
 872 * the reply tag.
 873 */
 874int tpm2_probe(struct tpm_chip *chip)
 875{
 876        struct tpm2_cmd cmd;
 877        int rc;
 878
 879        cmd.header.in = tpm2_get_tpm_pt_header;
 880        cmd.params.get_tpm_pt_in.cap_id = cpu_to_be32(TPM2_CAP_TPM_PROPERTIES);
 881        cmd.params.get_tpm_pt_in.property_id = cpu_to_be32(0x100);
 882        cmd.params.get_tpm_pt_in.property_cnt = cpu_to_be32(1);
 883
 884        rc = tpm_transmit_cmd(chip, NULL, &cmd, sizeof(cmd), 0, 0, NULL);
 885        if (rc <  0)
 886                return rc;
 887
 888        if (be16_to_cpu(cmd.header.out.tag) == TPM2_ST_NO_SESSIONS)
 889                chip->flags |= TPM_CHIP_FLAG_TPM2;
 890
 891        return 0;
 892}
 893EXPORT_SYMBOL_GPL(tpm2_probe);
 894
 895struct tpm2_pcr_selection {
 896        __be16  hash_alg;
 897        u8  size_of_select;
 898        u8  pcr_select[3];
 899} __packed;
 900
 901static ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
 902{
 903        struct tpm2_pcr_selection pcr_selection;
 904        struct tpm_buf buf;
 905        void *marker;
 906        void *end;
 907        void *pcr_select_offset;
 908        unsigned int count;
 909        u32 sizeof_pcr_selection;
 910        u32 rsp_len;
 911        int rc;
 912        int i = 0;
 913
 914        rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY);
 915        if (rc)
 916                return rc;
 917
 918        tpm_buf_append_u32(&buf, TPM2_CAP_PCRS);
 919        tpm_buf_append_u32(&buf, 0);
 920        tpm_buf_append_u32(&buf, 1);
 921
 922        rc = tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE, 9, 0,
 923                              "get tpm pcr allocation");
 924        if (rc)
 925                goto out;
 926
 927        count = be32_to_cpup(
 928                (__be32 *)&buf.data[TPM_HEADER_SIZE + 5]);
 929
 930        if (count > ARRAY_SIZE(chip->active_banks)) {
 931                rc = -ENODEV;
 932                goto out;
 933        }
 934
 935        marker = &buf.data[TPM_HEADER_SIZE + 9];
 936
 937        rsp_len = be32_to_cpup((__be32 *)&buf.data[2]);
 938        end = &buf.data[rsp_len];
 939
 940        for (i = 0; i < count; i++) {
 941                pcr_select_offset = marker +
 942                        offsetof(struct tpm2_pcr_selection, size_of_select);
 943                if (pcr_select_offset >= end) {
 944                        rc = -EFAULT;
 945                        break;
 946                }
 947
 948                memcpy(&pcr_selection, marker, sizeof(pcr_selection));
 949                chip->active_banks[i] = be16_to_cpu(pcr_selection.hash_alg);
 950                sizeof_pcr_selection = sizeof(pcr_selection.hash_alg) +
 951                        sizeof(pcr_selection.size_of_select) +
 952                        pcr_selection.size_of_select;
 953                marker = marker + sizeof_pcr_selection;
 954        }
 955
 956out:
 957        if (i < ARRAY_SIZE(chip->active_banks))
 958                chip->active_banks[i] = TPM2_ALG_ERROR;
 959
 960        tpm_buf_destroy(&buf);
 961
 962        return rc;
 963}
 964
 965static int tpm2_get_cc_attrs_tbl(struct tpm_chip *chip)
 966{
 967        struct tpm_buf buf;
 968        u32 nr_commands;
 969        __be32 *attrs;
 970        u32 cc;
 971        int i;
 972        int rc;
 973
 974        rc = tpm2_get_tpm_pt(chip, TPM_PT_TOTAL_COMMANDS, &nr_commands, NULL);
 975        if (rc)
 976                goto out;
 977
 978        if (nr_commands > 0xFFFFF) {
 979                rc = -EFAULT;
 980                goto out;
 981        }
 982
 983        chip->cc_attrs_tbl = devm_kcalloc(&chip->dev, 4, nr_commands,
 984                                          GFP_KERNEL);
 985
 986        rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY);
 987        if (rc)
 988                goto out;
 989
 990        tpm_buf_append_u32(&buf, TPM2_CAP_COMMANDS);
 991        tpm_buf_append_u32(&buf, TPM2_CC_FIRST);
 992        tpm_buf_append_u32(&buf, nr_commands);
 993
 994        rc = tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE,
 995                              9 + 4 * nr_commands, 0, NULL);
 996        if (rc) {
 997                tpm_buf_destroy(&buf);
 998                goto out;
 999        }
1000

1001        if (nr_commands !=
1002            be32_to_cpup((__be32 *)&buf.data[TPM_HEADER_SIZE + 5])) {
1003                tpm_buf_destroy(&buf);
1004                goto out;
1005        }
1006
1007        chip->nr_commands = nr_commands;
1008
1009        attrs = (__be32 *)&buf.data[TPM_HEADER_SIZE + 9];
1010        for (i = 0; i < nr_commands; i++, attrs++) {
1011                chip->cc_attrs_tbl[i] = be32_to_cpup(attrs);
1012                cc = chip->cc_attrs_tbl[i] & 0xFFFF;
1013
1014                if (cc == TPM2_CC_CONTEXT_SAVE || cc == TPM2_CC_FLUSH_CONTEXT) {
1015                        chip->cc_attrs_tbl[i] &=
1016                                ~(GENMASK(2, 0) << TPM2_CC_ATTR_CHANDLES);
1017                        chip->cc_attrs_tbl[i] |= 1 << TPM2_CC_ATTR_CHANDLES;
1018                }
1019        }
1020
1021        tpm_buf_destroy(&buf);
1022
1023out:
1024        if (rc > 0)
1025                rc = -ENODEV;
1026        return rc;
1027}
1028
1029/**
1030 * tpm2_auto_startup - Perform the standard automatic TPM initialization
1031 *                     sequence
1032 * @chip: TPM chip to use
1033 *
1034 * Returns 0 on success, < 0 in case of fatal error.
1035 */
1036int tpm2_auto_startup(struct tpm_chip *chip)
1037{
1038        int rc;
1039
1040        rc = tpm_get_timeouts(chip);
1041        if (rc)
1042                goto out;
1043
1044        rc = tpm2_do_selftest(chip);
1045        if (rc && rc != TPM2_RC_INITIALIZE)
1046                goto out;
1047
1048        if (rc == TPM2_RC_INITIALIZE) {
1049                rc = tpm_startup(chip);
1050                if (rc)
1051                        goto out;
1052
1053                rc = tpm2_do_selftest(chip);
1054                if (rc)
1055                        goto out;
1056        }
1057
1058        rc = tpm2_get_pcr_allocation(chip);
1059        if (rc)
1060                goto out;
1061
1062        rc = tpm2_get_cc_attrs_tbl(chip);
1063
1064out:
1065        if (rc > 0)
1066                rc = -ENODEV;
1067        return rc;
1068}
1069
1070int tpm2_find_cc(struct tpm_chip *chip, u32 cc)
1071{
1072        int i;
1073
1074        for (i = 0; i < chip->nr_commands; i++)
1075                if (cc == (chip->cc_attrs_tbl[i] & GENMASK(15, 0)))
1076                        return i;
1077
1078        return -1;
1079}
1080